1 matches found
RUSTSEC-2026-0245 Relative/Absolute Path Traversal (CWE-23/CWE-36) in `decompress_impl` that enables an arbitrary file write.
Summary All versions of sevenz-rust fail to validate file paths when extracting in decompressimpl the underlying function used in the exposed decompress api functions. This oversight allows a maliciously crafted archive to extract outside the extraction directory, from both relative paths such as...
8.3CVSS5.6AI score
SaveExploits0References2
20